Cold Email Laws in Poland: Consent First, Even for B2B, or a 3% Fine

October 5, 2026. Cold email to Poland needs the recipient's prior consent, and since November 10, 2024 that includes a company inbox. Article 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej, the Act of July 12, 2024, Journal of Laws 2024 item 1221) prohibits using telecommunications terminal equipment or automated calling systems to send commercial information, including direct marketing, to a subscriber or end user who has not agreed in advance. The President of UKE, the Office of Electronic Communications, can fine a sender that skips consent up to 3 percent of the previous calendar year's revenue or up to PLN 1,000,000, whichever is higher, under Article 446(5). The email rule it replaced, Article 10 of the 2002 Act on Providing Services by Electronic Means, protected only recipients who are natural persons; it was repealed the day the new law took effect.

What Article 398 says, clause by clause

1. Consent before the first message, for any end user. Article 398(1) bans using automated calling systems, and terminal equipment, in particular within interpersonal communication services, to send commercial information, including direct marketing, to a subscriber or end user who has not consented beforehand. Article 2 defines an end user as an entity using a publicly available communications service for its own needs, which a company is.
2. Consent can be an address given for that purpose. Article 398(2) lets a subscriber or end user consent by making available an electronic address that identifies them, for the purpose of receiving commercial information at that address. An address printed on a website or listed in a directory was published so people can make contact, not given for that purpose.
3. No cost to the recipient. Article 398(3) says commercial information sent this way may not be sent at the end user's or subscriber's expense.
4. A breach is also unfair competition. Article 398(4) makes the conduct in Article 398(1) an act of unfair competition under the Act of April 16, 1993 on combating unfair competition, so a competitor can sue while the regulator fines.

What counts as commercial information comes from Article 2(2) of the 2002 Act: any information intended directly or indirectly to promote goods, services or the image of a business or a regulated professional, except information that only enables electronic contact with a specific person and information that serves no commercial effect for whoever commissions it. A cold email offering a call to present your services promotes them, and on that definition so does a first email that introduces the company and asks whether you may send more. Because Article 398(1) also names interpersonal communication services, moving the pitch into a messaging channel does not obviously escape the rule; our guide to how the email laws read on LinkedIn messages covers that question.

What changed on November 10, 2024

The Electronic Communications Law took effect on November 10, 2024. Its companion statute, the Act of July 12, 2024 introducing the Electronic Communications Law (Journal of Laws 2024 item 1222), repealed the Telecommunications Law of July 16, 2004 in its Article 68, with narrow exceptions, and in its Article 26 amended the 2002 Act on Providing Services by Electronic Means: point 3 repealed Article 10 and point 5 repealed Article 24. Old Article 10(1) prohibited unsolicited commercial information addressed to a designated recipient who is a natural person, in particular by email, and old Article 24 made sending it a petty offence, prosecuted at the injured party's request. Article 398 extends the rule of Article 172 of the 2004 law, which UKE described as barring terminal equipment and automated calling systems for direct marketing without prior consent. The result is one consent rule for email, SMS and calls, covering companies as well as people, with an administrative fine behind it.

Who enforces it, and what they have fined

Three regulators can reach a cold sequence into Poland. UKE fines the missing consent under Article 446(5), which switches off the paragraphs that elsewhere average a small firm's revenue and cap its fine at PLN 15,000. UOKiK, the Office of Competition and Consumer Protection, pursues marketing contact without consent as a practice infringing collective consumer interests. UODO, the data protection authority, enforces the GDPR on the personal data in your list, under the GDPR's own ceiling of EUR 20 million or 4 percent of worldwide annual turnover, whichever is higher, in Article 83(5).

The UKE consent decisions published on its site predate the new law and concern calls. On June 28, 2019 UKE fined Koksztys S.A. PLN 80,000 for 30,636 marketing calls placed on its behalf without the required consents, and on November 5, 2019 it fined Tani Opał sp. z o.o. PLN 500,000 for 2,180,360 marketing calls made between January 1 and October 16, 2017. The newest decision is UOKiK's. In a decision announced on September 9, 2026 it fined Centrum Dotacji OZE PLN 308,728, and its then management board president PLN 100,000 personally, for telemarketing to consumers from purchased databases and from numbers generated by an algorithm. The reasoning matters for every outbound team: holding a number is not consent, buying it inside a database from another company is not consent, some of the purchased data predated the company itself, and a call meant to create interest and book a sales meeting is direct marketing even if the price comes later. UOKiK's president summed up the order as "first the consumer's consent, then the telephone call". The manager's liability turned partly on his signing the contracts with the database suppliers. The decision is not final and is open to appeal.

Consent that holds up under Article 400

Article 400 applies the data protection rules, accordingly, to obtaining consent, which imports the GDPR standard: a freely given, specific, informed and unambiguous indication of the person's wishes, as easy to withdraw as to give. DLA Piper's Poland guide spells out the practice. The person must give consent themselves, by ticking a box or answering yes, never through a pre-selected default; the consent should name the channel, such as SMS, telephone or email, the purpose and the entity it is given to; it should be separate from consent to process personal data; and consents collected before November 10, 2024 stay valid only if they already met those conditions. The same guide notes that processing a lead's data for your own marketing can rest on legitimate interest under GDPR Article 6(1)(f), subject to the right to object. That covers holding the data, not sending to it: Article 398 still requires consent before the commercial message.

The list problem: brokers, registries and Article 14

A purchased list fails Article 398 for the reason UOKiK gave. Building your own list from Polish public registers raises a separate GDPR duty. In 2019 UODO fined Bisnode, now Dun and Bradstreet, a little over PLN 943,000 because it took data from publicly available registers such as KRS, CEIDG and REGON and informed only the people it held email addresses for, and on September 19, 2023 the Supreme Administrative Court dismissed the company's cassation appeal, UODO reported. Article 14 of the GDPR requires telling each person whose data you collected from another source who you are and what you will do with it, at the latest within one month, or at the first contact if you use the data to contact them. Our guides to whether buying B2B email lists is legal and scraping for lead generation cover the list side in more depth.

What it means for operators

On the scale our country-by-country table uses, Poland now belongs in the prior-consent group with no business exception, beside Germany and Austria, and the opt-in vs opt-out map shows where the rest of Europe sits. A sequence to scraped or purchased Polish addresses breaks Article 398 on the first send, whether the inbox belongs to a person or to a company, and the exposure stacks: a UKE fine measured against your revenue, a UOKiK case if consumers are reached, a GDPR case at UODO, and an unfair competition claim from a rival. The routes that hold produce consent before the pitch: an inbound form that captures channel-specific consent, a webinar sign-up that says you will email offers, a referral where the prospect writes first. Record each consent with its channel, purpose and timestamp, and keep suppression inside the system that sends, which is how our email infrastructure builds are set up. An AI SDR changes nothing: the business that deploys it is still the sender. Article 398 also names automated calling systems, so an AI voice agent that dials Polish numbers with an offer needs the same prior consent, while an agent that only answers calls customers place to you, like the after-hours call answering we set up for home services firms, is a different activity because the customer started the conversation. For Poland the work starts with the consent event, not the list, and that is how we scope lead generation and cold email for EU markets.